Analysis
- max time kernel
145s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 09:03
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target sample.html
- Size 213KB
- Sample240613-kz2e6ssbpc
- SHA256 7632e19339098b4590098958abd168b4e7c6cc8a44c2001f867c67d86af24444
- MD5 b020dcb4a00cb168b20ce81bd179f7db
- SHA1 a19d3990df1ef2c38a72bd09bade536f3ca0d911
- SHA512 88258666ba2c44d7d7d8c21188134b48f4e8d67d9ee0038268dd4f25fbf7520943bf5214e6b3dd30eb6b81cd4482e49569abf8d78c15db168c801b41852eb0f6
- SSDEEP 3072:SOqga4EwGF/pRyfkMY+BES09JXAnyrZalI+YQ:SOtauwUsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1576 msedge.exe 1576 msedge.exe 1124 msedge.exe 1124 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1124 msedge.exe 1124 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe 1124 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1124 wrote to memory of 2504 1124 msedge.exe 82 PID 1124 wrote to memory of 2504 1124 msedge.exe 82 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 212 1124 msedge.exe 83 PID 1124 wrote to memory of 1576 1124 msedge.exe 84 PID 1124 wrote to memory of 1576 1124 msedge.exe 84 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85 PID 1124 wrote to memory of 2452 1124 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d79046f8,0x7ff8d7904708,0x7ff8d79047182⤵PID:2504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5569052333907142998,14310047324611648817,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,5569052333907142998,14310047324611648817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,5569052333907142998,14310047324611648817,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:2452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5569052333907142998,14310047324611648817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2116 /prefetch:12⤵PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5569052333907142998,14310047324611648817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5569052333907142998,14310047324611648817,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3600
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716
- MD5 c5abc082d9d9307e797b7e89a2f755f4
- SHA1 54c442690a8727f1d3453b6452198d3ec4ec13df
- SHA512 ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280
- MD5 b4a74bc775caf3de7fc9cde3c30ce482
- SHA1 c6ed3161390e5493f71182a6cb98d51c9063775d
- SHA512 55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 1a4a913fc08bf1e95e82aa637f36b687cbb30de7abba40d6a541dfcdf6fd98d7
- MD5 15787b2c9f6c9e5069c85bacb7951c3a
- SHA1 3159938c9f78061bf6522967ae761a5c462d5f87
- SHA512 e02b87ad79b991769df7f682872fd28abe932ed2a70d162c582ed8987c119007f9e7a13cce28c18bf74131107746cd9828db89cc4d759d7777466aab3def4363
- SSDEEP 96:nJkBoxm/DQYmqi41zUeEcwpvWMoiVmdeHnaSWUWQyV+VDCziEwb:nJkrIslUebGWMXTWro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 03d008f5349546833100fd47c073021e172f9aef208b6c729427291a60871e2f
- MD5 3b4b2925f2a489744cf74b21923626b3
- SHA1 df1ba08b75b189afd0c69de65fbb1ce028059b93
- SHA512 2e74d7390ddc4480f42f00d9859251822e775be5134fd211273dc8fc737e549d7996f98b2799e9264b88e300abf3910aca57a19ae9e3681ec8ca024d14cb2111
- SSDEEP 96:nJkBoxm/Dnmqi41zXeEcwpvWMoiVmdeHnaSWUWQyV+VDCAiEwb:nJkr6slXebGWMXTWrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 0ae25bbcde99e1bd1f41abc57c691e3eb0fb0fc2450b066d37d97229ce770064
- MD5 ad4c4185561ceae6222d7cd196c13abf
- SHA1 18d474043cfdd12b41a87b5ef9cdeb65f7a512ed
- SHA512 f755af8d3058bb03cb68189c5f27ce41150fb4321124d93e62abe42fdcca325dd14c32d0c6fe500594365fabf123c4337d051424751985af1242937b6c2f492b
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupYSl8e2RUm9tv3z2OMDCRHG:A9iIxuERzA83h09RZxYxlirvaOMWRHqp
- MD5 SHA1 SHA512 SSDEEP